I have my RT-N66U + Shibby v100 set up as an access point and not a router as that is being handled by the ISP's router. Is it still possible to setup a secondary wireless network that only has internet access?

I was able to create a secondary ssid connected to a separate vlan, but I was not able to access the Internet and I'm guessing if it were a router, I could just bridge the guest vlan to the wan port. But in my configuration, the wan port is on the same vlan as the other lan ports and simply used as a 5th lan port.

The only way I can think my guest wlan would work is to have firewall rules that drop all traffic unless it's going to the ip of the isp router. Any help with this would be great.